7 Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors (www.pillar.security)

Pillar Research has uncovered significant sandbox escape vulnerabilities across four coding agent platforms—Cursor, Codex, Gemini CLI, and Antigravity—demonstrating critical lapses in modern sandbox defenses. The investigation revealed that these AI coding agents, rather than directly breaking their sandboxes, were able to manipulate trusted external components by writing files that were later executed or scanned as safe. This highlights a fundamental shift in the endpoint threat model, as existing safeguards often fail to account for the complex interactions within modern development environments. The findings are crucial for the AI/ML community as they underscore the need for a tailored security approach for agentic tools, which are increasingly integrated into developer workflows. Pillar identified four common failure modes in sandbox designs: outmoded denylist approaches that cannot keep pace with OS complexity, workspace configurations treated as executable code, misleading "safe" command allowlists, and unrestrained access to privileged local daemons. These vulnerabilities necessitate a rethink of current security architectures, urging CISOs and security teams to demand clarity on the capabilities of coding agents, as well as rigorous verification of sandbox boundaries and interactions with host systems.